Picture this: it’s ten minutes before a client call and someone on your team realizes they need Zoom. They type "Zoom download" into Google, click the top result, and follow the prompts. The page looks right, the installer runs cleanly, and Zoom opens without a problem. But something else came along for the ride.That is malvertising, not a phishing email and not a suspicious link from a stranger but a paid ad sitting at the very top of a Google search, dressed up to look exactly like the real thing.
What actually happens
Cybercriminals buy Google ads targeting searches that business users run all the time: "Adobe Acrobat download", "WinRAR", "Zoom installer", "7-Zip", "VLC media player". The ad sits above the legitimate result, sometimes directly above the software company’s own listing, and points to a convincing copy of the real download page. The URL is a slight variation of the real name, close enough to pass a quick glance but not the genuine site, and most people don’t check the address bar when Google has already done the searching for them.
The download can be almost anything: ransomware, a tool that hands someone else remote access to the machine, or a piece of software called an infostealer that quietly harvests passwords saved in the browser and sends them to an attacker without leaving any obvious sign. In some cases, the malicious installer also runs the real software alongside it, so the user sees a completed installation and has no reason to think anything went wrong.
The problem with "just be careful"
The standard security training most businesses run covers phishing emails, suspicious attachments, and links from strangers. All of that is worth doing, but not one part of it would have stopped the person who searched for Zoom and clicked the top result, because they did nothing wrong by any measure they had been taught.
There is also a trust problem with search itself, since most people assume that appearing at the top of Google means something has been verified. Paid search results carry a small "Sponsored" label, but it sits in a muted font that most users scan straight past.
The real exposure for your business
The entry point for this attack is any device where someone searches for and downloads software: the computer in Reception; the laptop a new staff member sets up themselves; the machine where someone grabs a free tool to get something done quickly. The more devices in a business, the wider the surface.
Passwords lifted from one machine do not stay there; an infostealer that pulls browser-saved credentials can give an attacker access to cloud accounts, accounting platforms, email, and internal systems, all without triggering any obvious alarm.
What actually helps
DNS filtering works like a doorman with a bad-actor list: before the browser loads a page, it checks whether the destination is already flagged, and if it is, the page never opens, regardless of how the user arrived at it. Endpoint detection tools watch what an installer actually does once it runs, the way a security guard watches behavior inside a building rather than checking faces at the door only. A genuine software installation moves through a system in predictable ways; a malicious one behaves differently, and that difference gets caught even when everything looks normal on screen.
A TSP (Technology Security Partner) can take most of the guesswork out entirely, setting a list of approved applications, managing which versions are in use, making sure new devices arrive with everything staff need already installed, and running security awareness training that covers this attack specifically rather than only phishing emails. When the right tools are already there, nobody needs to go searching for a download.
The uncomfortable truth is that better training will not fix this one. You cannot teach someone to distrust the top result on Google and still expect them to work efficiently. That is not a training problem. It is an infrastructure problem.
DNS filtering and endpoint detection are not optional extras. They are the layer that catches what training cannot, and they work silently in the background whether or not the user notices the "Sponsored" label.
Here is the quick check: ask your IT team or provider whether DNS filtering is active on your network and on devices that work remotely. If the answer is unclear or takes more than a minute to confirm, you have found the gap.
Borked PC deploys and manages both DNS filtering and endpoint detection as part of a properly built environment. We also handle software deployment so that staff never need to search for a download in the first place. The attack only works when the right tools are not already there. We make sure they are.
👉 New to Borked PC? Start by filling out our quick Right Fit Questionnaire to see if Borked PC could be the right IT and Cybersecurity Partner for you.
📞 Or schedule a free 15-minute call at a time that works for you: Book a call
Prefer to talk now? Give us a call at (610) 599-6195.